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13 August 1985 


MEMORANDUM FOR:. | 
BR) gM eee eee cel 
Deputy Chief, Special Security Center 


SUBJECT: SECOM Agenda Item for 21 August 1985, 
Co-utilization of Sensitive Compartmented 
Information Facilities (SCIFs) 


REFERENCES : A. Memo fr C/ISG to C/PPG dtd 25 July 1985 
B. Meeting/Discussions 6 August 1985 


Z 


It has been agreed that in any modification of DCID 1/19 or 
it equivalent, the SECOM publication entitled "Security Policy 
Manual for SCI Control Systems," it is necessary to include 
some wording relative to Co-utilization of SCIFs. The 
following is offered as a draft recommendation for inclusion in 
the Policy Manual for SCI Control Systems. Specifically, the 
proposed text is recommended for placement on page 5, following 
"13. Accreditation of SCIFs." 


"14. Co-utilization of SCIFs. In the interest of 
efficient use of resources and perpetuation of 4 
cocperation between agencies of the Community, 
co-utilization of industrial contractor SCIFs is 
encouraged. The mechanism for establishing such 
co-utilization is the Memorandum of Agreement (MOA). 


a. A MOA is an agreement in which a Cognizant 
Security Authority (CSA) permits another agency 
joint use of an industrial contractor SCIF. A MOA 
is required whenever one agency will utilize a 
contractor SCIF already under the security 
cognizance of another agency. A generally 
acceptable example format for documenting such an 
agreement is found in Defense Intelligence Agency 
Manual (DIAM) 50-5, Volume I. However, certain 
additional elements required are: 
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ds. Type of material to be used, processed or 
stored within the SCIF. (e.g. SI, TK, etc.) 


2. Type of storage required (open or closed). 


3. Anticipated volume of material (in terms of 
" security containers). 


4. Duration for which the co-utilization is 
requested. . 
An optional but not mandatory element would be the 
contract(3s) number(s) relative to the effoxsts on 
behalf of the requesting agency. 


b. If a formal MOA is utilized, the requesting agency is 
responsible for originating the document. Signatories 
at a minimum, must be responsible officials of the 
CSA, the requesting user agency and the contractor. 


contractors. Originators of MOA‘s are responsible for 
determining if classification (and the level) is 
required. 


c. Formal MOA's, by nature of the requirement for several 
signatories, are time consuming. In lieu of the 
formal MOA, exchange of electrical messages between 
CSAs and requesting agencies is permissible, provided 
they contain all appropriate elements and are approved 
by appropriate officials. A statement to the effect 
that standard MOA conditions will apply infers that ~ 
the conditions in the DIAM 50-5 example will be 
followed. The hard copies of the message exchange 
will then constitute documentation for the MOA. 


d. If a user agency desires the contractor to make any 
substantive changes in procedures or physical 
characteristics of a SCIF, the proposed changes must 
have the concurrence of the CSA 


e. It is imperative that the user agency notify the CSA 
when the co-utilization is no longer required. 


£. Co-utilization of computer systems at contractor 


facilities is a more complex issue. A MOA for 
co-utilization of a contractor SCIF does not 
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automatically include approval for joint use of 
computer systems with that SCIF. A separate MOA is 
required for co-utilizition of computer systems. The 
system itself must pe certified by a CSA as meeting 
the appropriate computer security standards. The 
system can only be operational if within an accredited 
SCIF. A MOA for joint use of a computer system is 
mandatory when two or more agencies are simultaneously 
processing SCI on the same system. A MOA may not be 
required only because multiple agencies make use of 
the same system. Different criteria are used to 
determine the CSA over & particular system, ©¢.g- 
highest percentage of use of the system? cognizance 
over the physical SCIF etc. Formal, written 
documentation to effect a MOA for computer systems is 
required although interim agreements for joint use may 
be enacted through electrical message exchange. pCID 
1/16 contains additional information concerning joint 
use of computer systems. (U) 
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